From 35639a0a77b76987187dd6fc1568dae4ffc7f5a6 Mon Sep 17 00:00:00 2001
From: McCabe Maxsted
Date: Fri, 5 Mar 2010 23:24:28 -0700
Subject: Applied ImageGLPickMaskCrashFix patch from Cool Viewer.

Fixes a bug in v1.23 that sometimes crashes the viewer when touching
(or camming on) an object which is being rezzed.

Patch by Henri Beauchamp.
(slviewer-0-v12350-ImageGLPickMaskCrashFix.patch)
---
 linden/indra/llrender/llimagegl.cpp | 23 +++++++++++++++++------
 linden/indra/llrender/llimagegl.h   |  1 +
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/linden/indra/llrender/llimagegl.cpp b/linden/indra/llrender/llimagegl.cpp
index 544eb80..2a8fe01 100644
--- a/linden/indra/llrender/llimagegl.cpp
+++ b/linden/indra/llrender/llimagegl.cpp
@@ -369,6 +369,7 @@ LLImageGL::~LLImageGL()
 	sImageList.erase(this);
 	delete [] mPickMask;
 	mPickMask = NULL;
+	mPickMaskSize = 0;
 	sCount--;
 }
 
@@ -379,6 +380,7 @@ void LLImageGL::init(BOOL usemipmaps)
 #endif
 
 	mPickMask		  = NULL;
+	mPickMaskSize	  = 0;
 	mTextureState       = NO_DELETE ;
 	mTextureMemory    = 0;
 	mLastBindTime     = 0.f;
@@ -1567,20 +1569,21 @@ void LLImageGL::updatePickMask(S32 width, S32 height, const U8* data_in)
 		//cannot generate a pick mask for this texture
 		delete [] mPickMask;
 		mPickMask = NULL;
+		mPickMaskSize = 0;
 		return;
 	}
 
 	U32 pick_width = width/2;
 	U32 pick_height = height/2;
 
-	U32 size = llmax(pick_width, (U32) 1) * llmax(pick_height, (U32) 1);
+	mPickMaskSize = llmax(pick_width, (U32) 1) * llmax(pick_height, (U32) 1);
 
-	size = size/8 + 1;
+	mPickMaskSize = mPickMaskSize/8 + 1;
 
 	delete[] mPickMask;
-	mPickMask = new U8[size];
+	mPickMask = new U8[mPickMaskSize];
 
-	memset(mPickMask, 0, sizeof(U8) * size);
+	memset(mPickMask, 0, sizeof(U8) * mPickMaskSize);
 
 	U32 pick_bit = 0;
 	
@@ -1594,7 +1597,7 @@ void LLImageGL::updatePickMask(S32 width, S32 height, const U8* data_in)
 			{
 				U32 pick_idx = pick_bit/8;
 				U32 pick_offset = pick_bit%8;
-				if (pick_idx >= size)
+				if (pick_idx >= mPickMaskSize)
 				{
 					llerrs << "WTF?" << llendl;
 				}
@@ -1631,7 +1634,15 @@ BOOL LLImageGL::getMask(const LLVector2 &tc)
 		S32 idx = y*width+x;
 		S32 offset = idx%8;
 
-		res = mPickMask[idx/8] & (1 << offset) ? TRUE : FALSE;
+		if (idx / 8 < (S32)mPickMaskSize)
+		{
+			res = mPickMask[idx/8] & (1 << offset) ? TRUE : FALSE;
+		}
+		else
+		{
+			llwarns << "Index out of range for mPickMask !" << llendl;
+			return FALSE;
+		}
 	}
 	
 	return res;
diff --git a/linden/indra/llrender/llimagegl.h b/linden/indra/llrender/llimagegl.h
index c8df101..c7114c3 100644
--- a/linden/indra/llrender/llimagegl.h
+++ b/linden/indra/llrender/llimagegl.h
@@ -190,6 +190,7 @@ public:
 private:
 	LLPointer<LLImageRaw> mSaveData; // used for destroyGL/restoreGL
 	U8* mPickMask;  //downsampled bitmap approximation of alpha channel.  NULL if no alpha channel
+	U32 mPickMaskSize;
 	S8 mUseMipMaps;
 	S8 mHasExplicitFormat; // If false (default), GL format is f(mComponents)
 	S8 mAutoGenMips;
-- 
cgit v1.1